HELP - How do I add AD group to desktop Power Users?

[Fran]

I have looked on the web and found an article or two on useing
Restricted Groups in Group Policy but I cannot seem to get this to
work. Here's what I need to do:

I have created a group: MFG Prog Users
and added about 30 users to this group in the OU "Manufacturing" (this
is a Windows 2000 server)

I want to create a policy (or script?) that will add the users of the
MFG PROG USERS group in the Manufacturing OU to the Power Users group
on Windows XP client machines. This needs to propogate domain wide as
these users can roam the building.

How can I do that without visiting every workstation and adding this
group manually? (a pain)

-Fran-

 

[Mark Heitbrink [MVP]]

Hi,

I have looked on the web and found an article or two on useing
Restricted Groups in Group Policy but I cannot seem to get this to
work. [...]

I think your problem is, that you try to apply this GPO on a OU,
where the Users are. But this is a computer policy ...

Mark

 

[Fran]

I still don't know how to do this. What do you mean? I understand the
diff. between users and computers but GP's have to belong to either
the site, the domain or an OU. I don't necessarily want this applied
to the whole domain but even if it were, how would it be handled? Is
there anywhere I can get instructions on how to accomplish this?

Hi,

I have looked on the web and found an article or two on useing
Restricted Groups in Group Policy but I cannot seem to get this to
work. [...]

I think your problem is, that you try to apply this GPO on a OU,
where the Users are. But this is a computer policy ...

Mark

 

[Mark Heitbrink [MVP]]

I still don't know how to do this. What do you mean?

Creat a OU, move all your computer accounts to it (not the DC ...)
create a gpo, link it to the OU.

Now you have a "target" where your gpo with its settings of
restricted groups can hit an objec´t.

If you do this on an OU, where onbly user objects are inside,
it doesn´t work, because you can´t apply computer security
settings to a User as a target.
Because a User is not a computer ...

Mark